IM callback routes bypass the auth middleware because IM platforms verify
their own signatures, so the downstream QA pipeline never received a
UserID/TenantRole. The Organization-shared knowledge base resolution gates
on a non-empty UserID, so IM-channel questions silently skipped shared KBs
while the Web path (which sets UserID via JWT auth) worked.
Inject a synthetic "system-<tenantID>" identity (mirroring the API-key path,
recognised by types.IsSyntheticUserID) plus a Viewer role when building the
IM session context. Viewer is the least privilege sufficient to retrieve
shared KBs.
Closes#1600
wizardchen
12ea490d89